View original (French)

REMOVE A REMOTE IPC$ SHARE

lise -  
 BoringBugz -
Hello everyone:

I believe someone has set up a remote IPC$ share on my computer without my knowledge, (probably through a Trojan), and it is obviously protected by a password.
I would like to know how to remove it, if anyone can help me...
Thank you...

4 answers

  1.
    brupala Posted messages 111148 Registration date   Status Member Last intervention   14 449
     
    No,
    don't worry, the ipc$ share, like print$, c$, d$, admin$, exists on all Windows systems. This is called administrative shares.
    You can see them all by right-clicking on My Computer >> Manage >> Shares.
    You can remove it, but that won't help you; you'd better create a user on your target machine and connect with their username and password, and you won't see this message anymore.

    And... there you go!
    2
  2. lise
     
    Thank you for the response, but I didn’t play with anything, this thing happened on its own, protected by a password that I don’t know, that’s why I’m worried!!!
    Otherwise, I did what you told me...
    1
    1. BoringBugz
       
      A dig-up but well..

      IPC$ is an administrative service originally created during the installation of a Microsoft OS, specifically Windows X. So being there by default, I advise against removing it as it serves a purpose and is invisible from the outside unless perhaps the machine has a virus.

      I’m scratching my head wondering how you found this system administrative user if you weren’t messing around with the net cmd..

      A quick word.. why rush to remove the following users:
      OWNER CREATOR, System, TrustedInstaller, not to mention the famous S-1-5-21-05493248552345-523753724213-62346245735-7456 which seems to have a lot of rights and wants to be on all my logical drives..

      xD

      Enjoy..
      0
  3. lise
     
    Thank you, Brupala...
    I'm feeling a bit more reassured now, but I've read some things about this IPC$ share, apparently it can be exploited by others, especially when I do a 'net share' in 'cmd', it clearly shows up as 'remote' property, even though I only have one machine, one connection. It appeared a few days ago, and I hadn't done anything.
    When I try to delete it using 'net share IPC$ /delete', it tells me 'access denied'! I am an administrator after all!
    I didn't understand the last part of your reply, could you clarify a bit more? I don't see what you mean and especially how to do it.
    Thanks again... hugs
    0
  4. brupala Posted messages 111148 Registration date   Status Member Last intervention   14 449
     
    Hello,
    why are you playing with netshares if you're not on a network?
    When in doubt, remove file and printer sharing from your network connections and also the client for Microsoft networks.

    And ... There you go!
    0